build-and-push-multiarch-image.yml

name: Build and push multi-arch image

on:
  workflow_call:
    inputs:
      imageName:
        required: false
        type: string
        default: ${{ github.event.repository.name }}
      dockerfilePath:
        required: false
        type: string
        default: Dockerfile
      context:
        required: false
        type: string
        default: .
      buildArgs:
        required: false
        type: string
      gitRef:
        required: false
        type: string
        default: ${{ github.sha }}
      arm64_runner_name:
        required: false
        type: string
        default: ubuntu-24.04-arm
      amd64_runner_name:
        required: false
        type: string
        default: ubuntu-latest
    secrets:
      BUILD_SECRETS:
        description: "Allows adding secrets to the docker build task - https://docs.docker.com/build/ci/github-actions/secrets"
        required: false
    outputs:
      imageTag:
        description: "The image tag for the built image"
        value: ${{ jobs.build-and-push-image.outputs.imageTag }}

jobs:
  build-and-push-image:
    name: Build and push image for ${{ inputs.imageName }}
    strategy:
      matrix:
        arch:
          - amd64
          - arm64
        include:
          - arch: amd64
            runner: ${{ inputs.amd64_runner_name }}
          - arch: arm64
            runner: ${{ inputs.arm64_runner_name }}
    runs-on: ${{ matrix.runner }}
    outputs:
      imageTag: ${{ steps.meta.outputs.version }}
      localSha: ${{ steps.local-head.outputs.sha }}
    permissions:
      id-token: write
      contents: read
      packages: write
    steps:
      - uses: docker/setup-docker-action@b2189fbf2a6592b51fee7cdd93ee2bfaeba733db # v5.1.0
        with:
          version: "version=28.5.2"

      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
        with:
          ref: ${{ inputs.gitRef }}
          show-progress: false

      - name: Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
        id: local-head

      - name: Generate Image Metadata
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/govuk/${{ inputs.imageName }}
          labels: |
            org.opencontainers.image.vendor=GDS
          tags: |
            type=raw,priority=500,value=${{ inputs.gitRef }},enable=${{ startsWith(inputs.gitRef, 'v') }}
            type=raw,priority=400,value=${{ steps.local-head.outputs.sha }},enable=${{ !startsWith(inputs.gitRef, 'v') }}

      - id: build-image
        uses: docker/build-push-action@bcafcacb16a39f128d818304e6c9c0c18556b85f # v7.1.0
        with:
          file: ${{ inputs.dockerfilepath }}
          context: ${{ inputs.context }}
          platforms: "linux/${{ matrix.arch }}"
          load: true
          provenance: false
          build-args: ${{ inputs.buildArgs }}
          labels: ${{ steps.meta.outputs.labels }}
          outputs: type=image,name=ghcr.io/${{ github.repository_owner }}/govuk/${{ inputs.imageName }},push-by-digest=true,name-canonical=true,push=true
          secrets: ${{ secrets.BUILD_SECRETS }}

      - id: export-digests
        env:
          DIGEST: "${{ steps.build-image.outputs.digest }}"
        run: |
          mkdir -p /tmp/digests
          touch "/tmp/digests/${DIGEST#sha256:}"

      - id: upload-digests
        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
        with:
          name: digests-${{ inputs.imageName }}-${{ matrix.arch }}
          path: /tmp/digests/*
          if-no-files-found: error
          retention-days: 1
          overwrite: true

  combine_manifests:
    name: Create Docker Manifests for Built Images
    needs:
      - build-and-push-image
    runs-on: ubuntu-latest
    permissions:
      id-token: write
      contents: read
      packages: write
    steps:
      - uses: docker/setup-docker-action@b2189fbf2a6592b51fee7cdd93ee2bfaeba733db # v5.1.0
        with:
          version: "version=28.5.2"

      - name: Download Digests
        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
        with:
          path: /tmp/digests
          pattern: digests-${{ inputs.imageName }}-*
          merge-multiple: true

      - uses: docker/setup-buildx-action@4d04d5d9486b7bd6fa91e7baf45bbb4f8b9deedd # v4.0.0

      - run: echo "sha=$(git rev-parse HEAD)" >> "$GITHUB_OUTPUT"
        id: local-head

      - name: Login to GitHub Container Registry
        uses: docker/login-action@4907a6ddec9925e35a0a9e82d7399ccc52663121 # v4.1.0
        with:
          registry: ghcr.io
          username: ${{ github.repository_owner }}
          password: ${{ secrets.GITHUB_TOKEN }}

      - name: Generate Image Metadata
        id: meta
        uses: docker/metadata-action@030e881283bb7a6894de51c315a6bfe6a94e05cf # v6.0.0
        with:
          images: |
            ghcr.io/${{ github.repository_owner }}/govuk/${{ inputs.imageName }}
          labels: |
            org.opencontainers.image.vendor=GDS
          tags: |
            type=raw,value=latest,enable=${{ github.ref == format('refs/heads/{0}', 'main') }}
            type=raw,priority=500,value=${{ inputs.gitRef }},enable=${{ startsWith(inputs.gitRef, 'v') }}
            type=raw,priority=400,value=${{ needs.build-and-push-image.outputs.localSha }},enable=${{ !startsWith(inputs.gitRef, 'v') }}

      - name: Create Manifest Lists
        env:
          IMAGEREF_PREFIX: 'ghcr.io/${{ github.repository_owner }}/govuk/${{ inputs.imageName }}'
        working-directory: /tmp/digests
        run: |
          tag_args=$(jq -cr '.tags | map("-t " + .) | join(" ")' <<< "$DOCKER_METADATA_OUTPUT_JSON")
          printf -v sources "${IMAGEREF_PREFIX}@sha256:%s " *
          # shellcheck disable=SC2086 # Intentional word-splitting on $tag_args and $sources.
          docker buildx imagetools create $tag_args $sources

      - name: Inspect Images
        env:
          IMAGEREF: 'ghcr.io/${{ github.repository_owner }}/govuk/${{ inputs.imageName }}:${{ steps.meta.outputs.version }}'
        run: |
          docker buildx imagetools inspect "$IMAGEREF"